Isaca Updated CRISC Exam Questions and Answers by harri

Using cloud-based backup tominimize the impactof a potential data loss event is a classic example ofrisk mitigation, which involves reducing risk to an acceptable level through proactive controls.

Monitoring the number of incidents with downtime exceeding the contract threshold is a critical KRI for assessing the effectiveness of infrastructure upgrades aimed at enhancing service availability. This metric directly reflects the provider's ability to meet agreed-upon service levels and helps identify areas requiring further improvement.

According to ISACA, a risk register is a tool to record and track the identified risks, their ratings, responses, and status. The primary purpose of a risk register is to provide a centralized view of risk for the organization, as it enables the consolidation, communication, and reporting of risk information across different levels, units, and functions. A risk register can also support the risk management process, such as risk identification, assessment, treatment, monitoring, and review.

Continuous monitoring of key risk indicators (KRIs) will provide an early warning so that proactive action can be taken, because it helps to detect and measure the changes or trends in the risk level or performance, and to alert the risk owners and stakeholders when the risk exceeds the predefined thresholds or targets. A KRI is a metric or indicator that helps to monitor and evaluate the likelihood or impact of a risk, or the effectiveness or efficiency of a control. A KRI can be quantitative or qualitative, and can be derived from internal or external sources. Continuous monitoring is a process of collecting and analyzing data on a regular or real-time basis, to provide timely and relevant information for decision making or action taking. Continuous monitoring of KRIs will provide an early warning, as it helps to identify and address the risk issues or incidents before they escalate or cause significant damage or disruption. Ensuring that risk will not exceed the defined risk appetite of the organization, providing a snapshot of the risk profile, and ensuring that risk tolerance and risk appetite are aligned are all possible outcomes of continuous monitoring of KRIs, but they are not the best answer, as they do not reflect the main purpose and benefit of continuous monitoring of KRIs, which is to provide an early warning. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.3.2, page 97